Pinhole access for elevated containerized process capability

Abstract

A system described herein may provide a technique for providing extended container capabilities via helper functions that are executed by an entity with a higher privilege level than that of the containerized process. In order to limit the opportunity for malicious or otherwise unauthorized use of such extended container capabilities, such helper functions may limit enabled arguments and/or otherwise limit utilization of functionality associated with a higher privilege level.

What is claimed is: 
     
       1. A device, comprising:
 one or more processors configured to:
 establish a private communication channel between a host and a containerized process; 
 determine a first privilege level of the containerized process, the first privilege level including a first set of actions associated with the host that the containerized process is authorized to request; 
 receive, by the host, a request from the containerized process over the private communication channel to perform a particular action, wherein the request includes a first set of arguments; 
 determine that the first set of actions associated with the containerized process does not include the requested particular action; 
 provide, based on determining that the first set of actions does not include the requested particular action and further based on the request being received over the private communication channel, a helper command at the host, the helper command being associated with a second privilege level including a second set of actions, the second set of actions including the particular action; and 
 execute, by the helper command, the requested particular action with a second set of arguments that includes one or more default values and is different from the first set of arguments, wherein executing the requested particular action with the second set of arguments includes replacing the first set of arguments with the one or more default values. 
 
 
     
     
       2. The device of  claim 1 , wherein the one or more processors are further configured to:
 receive, by the host, a request from the containerized process over the private communication channel to perform a second particular action; 
 determine that the first set of actions associated with the containerized process includes the requested second particular action; and 
 execute the requested second particular action. 
 
     
     
       3. The device of  claim 1 , wherein the private communication channel comprises a private domain socket, wherein containerized processes associated with the private communication channel are executed at the host. 
     
     
       4. The device of  claim 1 , wherein the host is associated with a plurality of discrete privilege categories including the first privilege level and the second privilege level. 
     
     
       5. The device of  claim 1 , wherein the containerized process is a child process of a host process running on the host. 
     
     
       6. The device of  claim 1 , wherein the containerized process is a particular containerized process of a plurality of containerized processes, wherein the private communication channel is inaccessible to the other containerized processes of the plurality of containerized processes. 
     
     
       7. The device of  claim 1 , wherein the one or more default values include a default socket endpoint value. 
     
     
       8. A non-transitory computer-readable medium, storing a plurality of processor-executable instructions to:
 establish a private communication channel between a host and a containerized process; 
 determine a first privilege level of the containerized process, the first privilege level including a first set of actions associated with the host that the containerized process is authorized to request; 
 receive, by the host, a request from the containerized process over the private communication channel to perform a particular action, wherein the request includes a first set of arguments; 
 determine that the first set of actions associated with the containerized process does not include the requested particular action; 
 provide, based on determining that the first set of actions does not include the requested particular action and further based on the request being received over the private communication channel, a helper command at the host, the helper command being associated with a second privilege level including a second set of actions, the second set of actions including the particular action; and 
 execute, by the helper command, the requested particular action with a second set of arguments that includes one or more default values and is different from the first set of arguments, wherein executing the requested particular action with the second set of arguments includes replacing the first set of arguments with the one or more default values. 
 
     
     
       9. The non-transitory computer-readable medium of  claim 8 , wherein the plurality of processor-executable instructions are further to:
 receive, by the host, a request from the containerized process over the private communication channel to perform a second particular action; 
 determine that the first set of actions associated with the containerized process includes the requested second particular action; and 
 execute the requested second particular action. 
 
     
     
       10. The non-transitory computer-readable medium of  claim 8 , wherein the private communication channel comprises a private domain socket where containerized processes associated with the private communication channel are executed at the host. 
     
     
       11. The non-transitory computer-readable medium of  claim 8 , wherein the host is associated with a plurality of discrete privilege categories including the first privilege level and the second privilege level. 
     
     
       12. The non-transitory computer-readable medium of  claim 8 , wherein the containerized process is a child process of a host process running on the host. 
     
     
       13. The non-transitory computer-readable medium of  claim 8 , wherein the containerized process is a particular containerized process of a plurality of containerized processes, wherein the private communication channel is inaccessible to the other containerized processes of the plurality of containerized processes. 
     
     
       14. The non-transitory computer-readable medium of  claim 8 , wherein the one or more default values include a default socket endpoint value. 
     
     
       15. A method, comprising:
 establishing a private communication channel between a host and a containerized process; 
 determining a first privilege level of the containerized process, the first privilege level including a first set of actions associated with the host that the containerized process is authorized to request; 
 receiving, by the host, a request from the containerized process over the private communication channel to perform a particular action, wherein the request includes a first set of arguments; 
 determining that the first set of actions associated with the containerized process does not include the requested particular action; 
 provide, based on determining that the first set of actions does not include the requested particular action and further based on the request being received over the private communication channel, a helper command at the host, the helper command being associated with a second privilege level including a second set of actions, the second set of actions including the particular action; and 
 executing, by the helper command, the requested particular action with a second set of arguments that includes one or more default values and is different from the first set of arguments, wherein executing the requested particular action with the second set of arguments includes replacing the first set of arguments with the one or more default values. 
 
     
     
       16. The method of  claim 15  further comprising:
 receiving, by the host, a request from the containerized process over the private communication channel to perform a second particular action; 
 determining that the first set of actions associated with the containerized process includes the requested second particular action; and 
 executing the requested second particular action. 
 
     
     
       17. The method of  claim 15 , wherein the private communication channel comprises a private domain socket where containerized processes associated with the private communication channel are executed at the host and the containerized process is a child process of a host process running on the host. 
     
     
       18. The method of  claim 15 , wherein the host is associated with a plurality of discrete privilege categories including the first privilege level and the second privilege level. 
     
     
       19. The method of  claim 15 , wherein the containerized process is a particular containerized process of a plurality of containerized processes, wherein the private communication channel is inaccessible to the other containerized processes of the plurality of containerized processes. 
     
     
       20. The method of  claim 15 , wherein the one or more default values include a default socket endpoint value.